Wireguard VPN interface support

[dean-at-evos]

Hi everyone,
We have a product under development that requires wireguard VPN support. Our product uses the ESP32-C3 SOC as the application host.

It seems that we will have to port the wireguard implementation over to Zephyr/ESP, I guess somewhat similar to this LwIP port. We would be contributing this port back to the wider project.

So I guess before we start on this I am wondering if there is anyone else out in the community that would be interested in contributing, or has maybe done some work down this road and would like to partner up. Also any support or pointers on the best/recommended approach or who would be a suitable Zephyr lead would be greatly appreciated.

Thanks for taking the time to read this far.

[jukkar]

I briefly looked at this few months ago, and was planning to use the LwIP port too. Unfortunately because of time constraints I did not proceed.
I think the biggest issue is to get the crypto support into mbedtls so that zephyr code can use it. The actual networking part should be much easier. It is possible to use the virtual network interface support in zephyr to create network interface for vpn traffic that sits on top of real net_if. I can certainly help you with review etc if needed.

[dean-at-evos]

Thanks for the pointers. I did have a brief look and scratched my head about the crypto stuff and where it would fit. I'll have a look into the mbedtls and see if that makes any sense to me :)

[prayassamriya]

@dean-at-evos Are you still working on porting this for zephyr rtos?

[dean-at-evos]

Greetings @prayassamriya ... I have had to move onto another project for a month or so more. I do have to get back to this, probably Q2 24.

[prayassamriya]

No problem. thanks for update.

[ChavanVarad]

Are you still planning to/are working on this project? I'm looking to get WireGuard to work on Zephyr as well, and I'm completely in the dark about the crypto stuff mentioned by @jukkar mentioned in this thread earlier. Any updates would be appreciated.

[jukkar]

FYI, I started to experiment with wireguard support. I do not have anything useful yet but will submit a PR when something works.

[dean-at-evos]

We would be glad to help with testing/review/development time. We have worked around needed this in the short term but it is moving up the priority list for us.

[jukkar]

Ok, currently I have a rough skeleton for this, it is missing some vital parts yet so after I get it in a better shape I could submit as a draft in a hope to get help for the development.

[r4space]

Out of interest, did this go any further?

[jukkar]

I am currently stuck on the crypto stuff and have not progressed lately. I used the lwip port as a base, it has its own implementation for the crypto. Porting that to zephyr is a bit challenging. Best would be if mbedtls would have needed crypto support needed by wireguard, but atm it does not have that.

[jukkar]

FYI I just submitted Wireguard VPN support PR as a draft in #86020. The PR is still WIP but can be experimented. The documentation is still very limited but I will improve it in future revisions of the PR.

[jukkar]

The WG PR #86020 is now ready for review, please take a look and if possible try it yourself.

[jukkar]

The Zephyr security working group did not accepted the crypto code from wireguard-lwip project, see comment in #86020. Unfortunately I do not have time nor enough expertise to work on the crypto lib and create suitable code in PSA libs. So I need to ask the community if anyone is willing to step up and provide needed crypto support for Wireguard, otherwise the VPN support is not going in to upstream.

[dean-at-evos]

This is a shame, but I guess I can understand their concerns.
Thanks so much for your work, I have only just got back to the product that we needed this for and we had a workaround using a private tls server ... but WG is our primary backend.
I will look at some other crypto options, but like you I am no expert in that field so it may be that we are left to use our workaraound for now.